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FIG. 2 shows the structure of an exemplary call detail record 50 received by 
fraud monitoring processor 28. Call detail record 50 includes one or more key 
data fields 52 (the contents of which are shown in the drawing as "Record i"), 
which uniquely identify the record. Attribute data in each record are 
designated 54-1 through 54-N, where N indicates the number of different 
attributes or characteristics of the call which the record describes. In the 
context of long distance calling, these attributes may include the calling 
number (54-1), the time of access (54-2), the terminating (called) number 
(54-3), the call duration (54-4), an indication of whether the call was 
complete or incomplete (54-5), the authorization code or 800 number used to 
gain access to the network (54-6), the type of originating station (e.g., a pay 
phone, ordinary telephone, cellular telephone, etc.) (54-7), or other 
attributes (54-N) which identify the call and may be useful in determining 
whether the call represents an abnormal use of the communication network for 
the subscriber. 
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